CVE-2026-17011
Received Received - Intake

Nexter Blocks WordPress Plugin Global CSS Stored XSS

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: WPScan

Description
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-17011
EUVD
EUVD-2026-54892

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpux the_nexter_blocks_plugin to 5.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Nexter Blocks WordPress plugin before version 5.0.2 has a stored CSS injection flaw. Users with at least the Contributor role can inject arbitrary CSS via an unrestricted REST endpoint. This CSS is then rendered site-wide on the front end, enabling defacement, content hiding, or UI redressing attacks.

Detection Guidance

Check the installed version of the Nexter Blocks plugin in WordPress. If it is below 5.0.2, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

This vulnerability allows attackers with Contributor access to modify site appearance, hide content, or trick users into interacting with malicious elements. It could lead to defacement of the website or compromise user experience and trust.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized content modifications, potentially violating data integrity or confidentiality requirements under GDPR or HIPAA if user data is exposed or manipulated.

Mitigation Strategies

Update the Nexter Blocks plugin to version 5.0.2 or later immediately. If updating is not possible, consider temporarily disabling the plugin or restricting Contributor role capabilities until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17011. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart